GDPR in the nonprofit sector — specifics and challenges
The General Data Protection Regulation (GDPR) applies to all entities processing personal data — including foundations, associations, and public benefit organizations. For the nonprofit sector, GDPR presents particular challenges because NGOs process data of many categories of individuals: donors, beneficiaries, volunteers, members, and partners. Each category requires a separate legal basis and different scope of protection.
Nonprofit organizations frequently process special categories of data within the meaning of Article 9 of the GDPR — data concerning the health of program beneficiaries, religious or political beliefs, and ethnic origin. Processing such data requires meeting additional conditions and implementing an elevated level of technical and organizational safeguards.
In practice, many NGOs are unaware of the full scope of their GDPR obligations. The lack of dedicated legal and IT resources leads to situations where organizations breach regulations not out of malice but out of ignorance. This guide aims to help foundations and associations understand and implement the most important data protection requirements.
Legal bases for data processing in NGOs
GDPR requires that every processing of personal data has a clear legal basis. For nonprofit organizations, four bases are most commonly used.
The first is consent of the data subject (Art. 6(1)(a)). This basis applies to collecting data for newsletters, marketing communications, and publishing images. Consent must be freely given, specific, and easy to withdraw.
The second is performance of a contract (Art. 6(1)(b)). This applies to processing volunteer data under a volunteer agreement, employee data under an employment contract, and donor data when fulfilling a designated donation.
The third is legal obligation (Art. 6(1)(c)). Foundations must process data required by tax regulations, accounting laws, and foundation statutes — regardless of individual consent.
The fourth is legitimate interest of the controller (Art. 6(1)(f)). NGOs can rely on this basis for correspondence, ensuring IT system security, and pursuing claims. This requires documenting a balancing test.
Records of processing activities — every organization’s obligation
Every foundation and association processing personal data is required to maintain Records of Processing Activities (RoPA) under Article 30 of the GDPR. The record should document every process in which the organization processes personal data.
Typical processing activities in an NGO include: maintaining a donor database, managing volunteering, delivering aid programs, running accounting and HR, sending newsletters, operating a website and social media, organizing events and fundraisers, and collaborating with grantmakers.
For each activity, the record should contain: the purpose of processing, categories of individuals and data, data recipients, planned deletion deadline, and a description of technical and organizational safeguards applied. The record must be kept up to date and made available to the supervisory authority upon request.
Donor data — what is and is not permitted
Processing donor data requires particular attention as it involves financial data. When accepting a donation, the organization may collect the donor’s identification data (name, surname, address), transaction data (amount, date, purpose of donation), and contact data (email, phone) — only to the extent necessary to execute the donation and fulfill tax obligations.
The organization may not share donor data with other entities without a legal basis. It may not use data collected for donation processing for marketing purposes without separate consent. It may not store data longer than the processing purpose requires.
CRM systems storing donor data must meet security requirements: encryption of data at rest and in transit, role-based access control, logging of data operations, and regular backup creation. A security audit of the CRM system should be conducted at least annually.
Beneficiary data — elevated protection for sensitive data
Data of program beneficiaries often constitutes special categories of personal data under Article 9 of the GDPR. A foundation helping domestic violence victims processes data concerning mental health and family circumstances. An organization supporting homeless individuals collects information about social status. An association working for ethnic minorities processes data about origin.
Processing such data requires meeting one of the conditions set out in Article 9(2) of the GDPR — most commonly explicit consent or the necessity of processing for preventive health or social security purposes. The organization must implement enhanced safeguards: data pseudonymization, access restriction to the necessary minimum, encryption of storage media and transmissions, and physical security of paper documentation.
A beneficiary data leak can have catastrophic consequences — from discrimination to direct threats to individuals’ safety. Therefore, securing this data should be the organization’s priority.
Data Protection Officer in an NGO
Appointing a Data Protection Officer (DPO) is mandatory when the organization processes data on a large scale or processes special categories of data as a significant part of its activities. In practice, most foundations delivering aid programs should appoint a DPO.
The DPO can be an employee of the organization or an external person. For smaller NGOs, outsourcing the DPO function to a specialized firm is a solution — it provides access to professional legal expertise without the need to employ a full-time specialist.
Key DPO tasks in an NGO include: monitoring processing compliance with GDPR, training staff and volunteers, maintaining records of processing activities, handling requests from data subjects, conducting Data Protection Impact Assessments (DPIA) for high-risk processes, and cooperating with the supervisory authority in case of inspections or breaches.
Data breach — notification procedure
Every nonprofit must have a procedure for responding to personal data breaches. A breach is any event leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
In the event of a breach, the organization has 72 hours to notify the supervisory authority — counted from the moment the breach is detected. The notification should include a description of the breach, categories and approximate number of affected individuals, possible consequences, and remedial measures taken.
If the breach is likely to result in a high risk to the rights and freedoms of individuals, the organization must additionally notify the affected data subjects. In practice, this means individually informing donors or beneficiaries about the leak of their data.
A professional incident response plan helps minimize damage and meet legal obligations within the deadline. nFlo supports organizations in developing procedures and handling security incidents.
Data processing agreements with IT vendors
Every organization using external IT services — hosting, CRM, email, fundraising tools — entrusts personal data processing to third parties. GDPR requires concluding a data processing agreement (Article 28) with each such provider.
The processing agreement must specify the subject matter and duration of processing, its nature and purpose, types of data and categories of individuals, and the obligations and rights of the controller. Before entrusting processing, the organization should verify that the provider ensures appropriate security guarantees — ISO 27001 certifications, security policies, incident response procedures.
Particular attention should be paid to data transfers outside the European Economic Area. Many popular cloud tools store data on servers in the US — this requires additional legal safeguards (Standard Contractual Clauses) and technical measures (end-to-end encryption).
Practical GDPR implementation in a nonprofit
GDPR implementation in an NGO can be divided into stages. The first is inventory — identifying all processes in which the organization processes personal data and creating Records of Processing Activities.
The second is gap analysis — comparing current practices with GDPR requirements and identifying areas needing improvement. The third is implementing technical safeguards: encryption, access control, backups, MFA, monitoring.
The fourth is developing documentation: data protection policy, breach notification procedure, privacy notice templates, data processing agreement templates, and authorization register. The fifth is training staff and volunteers — without team awareness, even the best documentation remains a dead letter.
nFlo offers comprehensive support in aligning nonprofit IT infrastructure with GDPR requirements — from technical audits to implementing safeguards and team training.
